Enter your authenticator secret key to generate a real-time verification code.
Compatible with Google Authenticator, Authy, and other TOTP apps.
Have a QR code? Click the image icon, drag & drop, or press Ctrl+V anywhere.
Your secret is only sent to generate the code and is never stored.
For API usage, prefer POST over GET to keep secrets out of URLs.
Generate the same time-based codes your production apps expect — not mock values.
A live timer shows exactly when the current code expires, so you never miss the window.
Use the browser tool for quick checks, or call the REST endpoint from your test scripts and CI pipelines.
Enter a base32 secret or otpauth:// URI from your authenticator setup.
Click Generate Code to get the current 6-digit TOTP value with a live refresh timer.
Use the code in your app, API test, or login flow — then grab the next one when it rotates.
No. Your secret is only used to generate the current code and is never stored on our servers.
Both work. Prefer POST when calling the API — it keeps secrets out of URLs, server logs, and browser history.
Base32 secrets (e.g. JBSWY3DPEHPK3PXP) and full otpauth:// URIs. Spaces and dashes in secrets are stripped automatically.
Any standard TOTP app — Google Authenticator, Authy, 1Password, Microsoft Authenticator, and others.
Yes. Hit /2fa or /totp with your secret via GET query param or POST JSON body. The response includes the code and seconds until refresh.
Paste your secret above or integrate the API into your test suite.
Try it above